GhostTrace – a Windows forensic scanner that finds what "Uninstall"…

I built a CLI tool for Windows that investigates software remnants across 22 forensic modules in a single pass.

The idea: when you uninstall software, it says goodbye — but registry keys, prefetch entries, scheduled tasks, WMI subscriptions, BAM/DAM timestamps and more often stay behind. GhostTrace finds all of it.

What it covers:

Persistence (MITRE ATT&CK TA0003): Run/RunOnce keys, services, IFEO debugger, AppInit_DLLs, scheduled tasks via Task Scheduler COM API, WMI EventFilter/Consumer bindings
Execution evidence (TA0002): Shimcache (AppCompatCache), Prefetch with XPRESS-Huffman decode (versions 26/30/31), BAM/DAM with per-SID last-run timestamps, UserAssist (ROT13), MUICache
User activity: PowerShell history with cradle/encoded payload detection, RDP outbound history, RecentDocs, USB device history via USBSTOR, network artifacts (hosts redirects + connected networks)
Installed software and disk residue: uninstall entries, startup approved state, filesystem trace in Program Files/ProgramData/AppData

Design decisions:

Read-only by default — scan never touches anything
Cleanup only after explicit typed confirmation (no implicit click)
Execution caches and history are excluded from cleanup — you don't destroy evidence
Zero network calls, zero telemetry
Suspicious signal is data for analysis, not an automatic verdict

Stack: C# · .NET 10 · Spectre.Console · Windows 10/11 x64

Download on GitHub: github.com/Devzinh/GhostTrace

Happy to answer questions about the forensic modules or implementation decisions.

Impact

GhostTrace itself is not a vulnerability or exploit but a forensic tool that helps identify residual artifacts left by uninstalled software. It does not introduce security risks or exploits. Its impact is to aid incident responders and forensic analysts in uncovering persistence and execution evidence that standard uninstall processes leave behind, improving visibility into potential attacker activity or system state.

Defensive guidance

This is a forensic scanning tool, not a vulnerability requiring patching or mitigation. No remediation or patch is applicable. Users should apply GhostTrace as intended for investigative purposes. Since it is read-only and offline, it does not pose risk to system integrity or privacy.

Summary

GhostTrace is a command-line forensic scanner for Windows that identifies leftover artifacts from software uninstallations across 22 forensic modules. It covers persistence mechanisms (e.g., Run keys, services, scheduled tasks, WMI bindings), execution evidence (e.g., Shimcache, Prefetch, BAM/DAM timestamps), user activity (e.g., PowerShell history, RDP history, USB device history), and installed software traces (e.g., uninstall entries, filesystem residues). The tool is read-only by default, does not alter system state, excludes execution caches and history from cleanup, and performs no network communication or telemetry. It is implemented in C# on .NET 10 and supports Windows 10/11 x64.

GhostTrace – a Windows forensic scanner that finds what "Uninstall" leaves behind (22 modules, read-only, offline)

Discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

AI analysisMachine-generated, updated 10 Jun 2026, 06:55 UTC

Technical details

References

Community reviews

Related threats